Network based audience measurement

ABSTRACT

Methods, systems, and computer-readable media for providing network-based audience measurement are provided. Data packets are intercepted between a client computer and a content server. Unique subscribers and content names are identified based on the data packets. One or more audience measurement metrics are computed based on the unique subscribers and the content names.

BACKGROUND

This application relates generally to the field of computer networks.More specifically, the disclosure provided herein relates tonetwork-based audience measurement.

Internet service providers may be interested in the amount of time thatusers spend online accessing content controlled and provided by Internetcontent providers. The determination of the amount of time that usersspend online accessing content may be referred to as audiencemeasurement. For example, service providers may utilize audiencemeasurement data to determine the popularity of websites and content andto establish advertising rates. Audience measurement is conventionallyperformed using one of two implementations: (1) a server-sideimplementation and (2) a client-side implementation.

In the server-side implementation, a content provider may maintainserver logs that record accesses to servers controlled by the contentprovider. For example, each time a user accesses a server controlled bythe content provider, the content provider may record the user'sInternet Protocol (“IP”) address in the corresponding server log.However, separate server logs are typically maintained by differentcontent providers, and some of the content providers may not release theserver logs to the service provider. Further, since the server logssimply record IP addresses, the server logs may not be accurate as tothe number of unique subscribers (e.g. multiple subscribers may access aserver under the same, dynamically-assigned IP address).

In the client-side implementation, a service provider installs amonitoring device at or near each customer's computer and monitors theInternet usage of each customer through the monitoring device. The needto install a separate monitoring device for each customer can be costprohibitive and may not be scalable. Further, due to the intrusivenature of the monitoring device, few customers may grant permission tothe service provider to install the monitoring device, resulting in arelatively small sample size. Those few customers that do grantpermission may only do so upon receiving some benefit in exchange, suchas monetary payment, from the service provider.

SUMMARY

Embodiments of the disclosure presented herein include methods, systems,and computer-readable media for providing network-based audiencemeasurement. According to one aspect, a method for providingnetwork-based audience measurement is provided. According to the method,data packets are intercepted between a client computer and a contentserver. Unique subscribers and content names are identified based on thedata packets. One or more audience measurement metrics are computedbased on the unique subscribers and the content names.

According to another aspect, a system for providing network-basedaudience measurement is provided. The system includes a memory and aprocessor functionally coupled to the memory. The memory stores aprogram containing code for providing network-based audiencemeasurement. The processor is responsive to computer-executableinstructions contained in the program and configured to perform thefollowing operations. Data packets are intercepted between a clientcomputer and a content server. Unique subscribers and content names areidentified based on the data packets. One or more audience measurementmetrics are computed based on the unique subscribers and the contentnames.

According to yet another aspect, a computer-readable medium havinginstructions stored thereon for execution by a processor to perform amethod for providing network-based audience measurement is provided.According to the method, data packets are intercepted between a clientcomputer and a content server. Unique subscribers and content names areidentified based on the data packets. One or more audience measurementmetrics are computed based on the unique subscribers and the contentnames.

Other systems, methods, and/or computer program products according toembodiments will be or become apparent to one with skill in the art uponreview of the following drawings and detailed description. It isintended that all such additional systems, methods, and/or computerprogram products be included within this description, be within thescope of the present invention, and be protected by the accompanyingclaims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating an exemplary network environmentconfigured to provide network-based audience measurement, in accordancewith some embodiments.

FIG. 2 is a flow diagram illustrating an exemplary method for providingnetwork-based audience measurement, in accordance with some embodiments.

FIG. 3 is a block diagram illustrating an exemplary computer systemconfigured to provide network-based audience measurement, in accordancewith some embodiments.

DETAILED DESCRIPTION

The following detailed description is directed to methods, systems, andcomputer-readable media for providing network-based audiencemeasurement. While the subject matter described herein is presented inthe general context of program modules that execute in conjunction withthe execution of an operating system and application programs on acomputer system, those skilled in the art will recognize that otherimplementations may be performed in combination with other types ofprogram modules. Generally, program modules include routines, programs,components, data structures, and other types of structures that performparticular tasks or implement particular abstract data types. Moreover,those skilled in the art will appreciate that the subject matterdescribed herein may be practiced with other computer systemconfigurations, including hand-held devices, multiprocessor systems,microprocessor-based or programmable consumer electronics,minicomputers, mainframe computers, and the like.

In the following detailed description, references are made to theaccompanying drawings that form a part hereof, and which are shown byway of illustration, specific embodiments, or examples. Referring now tothe drawings, in which like numerals represent like elements through theseveral figures, FIG. 1 is a block diagram illustrating an exemplarynetwork environment 100 configured to provide network-based audiencemeasurement, in accordance with some embodiments. The networkenvironment 100 may include a server computer 102, content server 104,and a client computer 106 coupled via a network 108, such as theInternet. Although only one server computer 102, one content server 104,and one client computer 106 are illustrated in FIG. 1, it should beappreciated that any suitable number of server computers, contentservers, and client computers in any suitable arrangement may besimilarly utilized. The server computer 102 may include an audiencemeasurement module 110. According to embodiment, the audiencemeasurement module 110 is configured to monitor a variety of audiencemeasurement metrics. The operation of the audience measurement module110 is described in greater detail below. The content server 104 mayprovide content 112 through a website 114 or directly to the clientcomputer 106. The content 112 may include any suitable multimedia,including text, images, audio, video, and combinations thereof.

The content server 104 may further include a web server 116 adapted todeliver the website 114 and/or the content 112 to the client computer106 upon request from the client computer 106. In particular, the clientcomputer 106 may request access to the website 114 and/or the content112 through a user agent 118. In one embodiment, the user agent 118 is aweb browser. In further embodiments, the user agent 118 may be anysuitable application adapted to request and receive the website 114and/or the content 112 from the server computer 102.

The network environment 100 may further include a domain name system(“DNS”) server 120, a provisioning system 122, a provisioning database124, a network access server (“NAS”) 126, a Remote Authentication DialIn User Service (“RADIUS”) server 128, a registry database 130, and anentity database 132. The DNS server 120 may be configured to receive aDNS query 134 containing a domain name (also referred to herein as acontent name). Upon receiving the DNS query 134, the DNS server 120 maytranslate the domain name to an IP address. The DNS server 120 may thenreturn the IP address corresponding to the domain name. It should beappreciated that the operation of the DNS server 120 is well known andwill not be described in further detail.

The client computer 106 may be associated with an IP address thatidentifies the client computer 106 over the network 108. The IP addressmay be assigned to a unique subscriber operating the client computer 106according to at least two implementations. In a first implementation,the provisioning system 122 may statically assign an IP address to themedia access control (“MAC”) address of a network device, such asnetwork devices 310 illustrated in FIG. 3, coupled to the clientcomputer 106. The provisioning database 124 may store provisioning data136 that includes data identifying the unique subscriber, the MACaddress of the network controller, and the assigned IP address, amongother information. In a second implementation, upon receiving a requestfrom the client computer 106, a network access server (“NAS”) 126 maytransmit an authorization request 138 to the RADIUS server 128. Theauthorization request 138 may include a unique subscriber's credentials,such as the subscriber's username and password. When the RADIUS server128 grants the authorization request 138, the RADIUS server 128 maydynamically assign an IP address to the unique subscriber. The RADIUSserver may then responds with an authorization response 140 thatincludes the subscriber's username and the assigned IP address, amongother information. It should be appreciated that the operations of theprovisioning system 122, the provisioning database 124, and the RADIUSserver 128 are well known and will not be described in further detail.

The registry database 130 may be configured to store registry data 142.According to embodiments, the registry data 142 includes dataidentifying IP addresses and content names corresponding to each of theIP addresses. For example, the registry data 142 may include datamapping the content name, www.att.com, to the IP address, 96.6.249.145.The entity database 132 may be configured to store entity data 144.According to embodiments, the entity data 144 includes data identifyingcontent names and entity names corresponding to each of the contentnames. For example, the entity data 144 may include data mapping contentnames, www.google.com, www.gmail.com, and www.picasa.com, to GOOGLE,INC. In this way, different content names owned or controlled by thesame entity can be consolidated.

According to embodiments, the audience measurement module 110 may beadapted to receive data packets that are intercepted by a sniffer 146 orother suitable device adapted to intercept data traffic. In particular,the sniffer 146 may be adapted to intercept one or more of thefollowing: (a) data traffic between the content server 104 and the useragent 118 accessing the content 112, (b) the DNS query 134, and (c) theauthorization response 140. Although only one sniffer is illustrated inFIG. 1, it should be appreciated that the network environment caninclude two or more sniffers in any suitable arrangement. According tofurther embodiments, the audience measurement module 110 may be furtheradapted to retrieve one or more of the following: (a) the provisioningdata 136 from the provisioning database 124, (b) the registry data 142from the registry database 130, and (c) the entity data 144 from theentity database 132.

According to embodiments, the audience measurement module 110 may mergethe intercepted data traffic, the intercepted DNS query 134, theintercepted authorization response 140, the provisioning data 136, theregistry data 142, and/or the entity data 144. The audience measurementmodule 110 may then identify unique subscribers and content names basedon merged information. In particular, the intercepted data packets mayeach include a Hypertext Transfer Protocol (“HTTP”) header specifying asource IP address, a destination IP address, and a timestamp that thedata packet was sent. The audience measurement module 110 may identify aunique subscriber that maps to the source IP address. The audiencemeasurement module 110 may identify the unique subscriber through theprovisioning data 136 retrieved from the provisioning database 124 orfrom the intercepted authorization response 140. In particular, theprovisioning database 124 and the authorization response 140 may includethe username or other suitable identifier identifying the uniquesubscriber associated with the source IP address.

The audience measurement module 110 may also identify a content namethat maps to the destination IP address. In some instances, the HTTPheader may also specify a content name. For example, if the user agent118 is a web browser and accesses the website 114, the user agent 118may transmit data packets having a HTTP header that specifies a contentname. However, in other instances, the HTTP header may not specify acontent name. In one example, if the user agent 118 is not a web browserand directly accesses the content 112, the user agent 118 may transmitdata packets having a HTTP header that does not specify a content name.In this case, the audience measurement module 110 may determine thecontent name through the DNS query 134. In particular, the DNS query 134may include the content name, among other information. In anotherexample, the user agent 118 is a web browser, but the user enters an IPaddress instead of a content name into the web browser. In this case,the audience measurement module 110 may determine the content namethrough the registry data 142. In particular, the registry data 142 maymap IP addresses to corresponding content names.

Upon identifying the unique subscribers and the content names, theaudience measurement module 110 may consolidate content names based onthe entity data 144, as previously described. The audience measurementmodule 110 may then apply one or more heuristics 148 adapted to separatemachine-generated data traffic from user-generated data traffic. Theaudience measurement module 110 may then remove the machine-generateddata traffic. Examples of the machine-generated data traffic mayinclude, but are not limited to, operating system and other softwareupdates and virus scanner data file updates.

The heuristics 148 may distinguish machine-generated data traffic fromuser-generated data traffic according to any suitable characteristics ofmachine-generated data traffic. In one example, the client computer 106may access a known update server (e.g., the WINDOWS UPDATE service fromMICROSOFT CORPORATION) to retrieve software updates. In this case, theheuristics 148 may remove data traffic to and from the update server. Inanother example, the user agent 118 may be a virus update applicationthat only accesses the network 108 in order to update virus data files.In this case, the heuristics 148 may remove data traffic to and from theuser agent 118. In yet another example, the client computer 106 mayaccess the content server 104 at fixed intervals (e.g., everytwenty-four hours, every six hours, every hour, etc.). In this case, theheuristics 148 may measure the inter-arrival times of data packets tothe content server 104. Those data packets having fixed inter-arrivaltimes may be removed.

Upon removing the machine-generated data traffic and leaving only theuser-generated data traffic, the audience measurement module 110 maycompute one or more audience measurement metrics based on the identifiedunique subscribers, the identified unique content names, and theuser-generated data traffic. The audience measurement metrics may becomputed according to application and/or content. For example, althoughdata traffic to the NEW YORK TIMES website and to the LOS ANGELES TIMESwebsite may be identified as separate data traffic to differentapplications (i.e., this example, websites), the audience measurementmodule may identify the data traffic together as text content.

In a first example, the audience measurement module 110 may compute thenumber of unique subscribers. In a second example, the audiencemeasurement module 110 may compute the total data traffic volume interms of the number of bytes transmitted and/or received. In a thirdexample, the audience measurement module 110 may compute the number ofdata flows (i.e., unique sessions) accessing the content server 104. Ina fourth example, the audience measurement module 110 may compute thenumber of hits generated. That is, a single data flow (e.g., aconnection to the NEW YORK TIMES website) may include separate accessesto multiple web objects (e.g., the sports page, the business page,etc.).

In a fifth example, the audience measurement module 110 may compute thetime spent downloading the content 112 by subtracting the start time ofa data flow from the end time of the data flow. In a sixth example, theaudience measurement module 110 may compute the time spent downloadingand viewing the content 112 by subtracting the start time of the currentcontent request from the start time of the next content request. If astart time of the next content request does not exist, then the starttime of the current content request is subtracted from the end time ofthe current data flow. When determining the total amount of time thatunique subscribers spend online, the audience measurement module 110 maydisregard traffic transmitted towards the client computer 106 where theclient computer 106 does not respond within a given time interval. Forexample, a probing system (not shown) may be adapted to probe the clientcomputer 106 in order to identify open ports.

It should be appreciated that the logical operations described hereinare implemented (1) as a sequence of computer implemented acts orprogram modules running on a computing system and/or (2) asinterconnected machine logic circuits or circuit modules within thecomputing system. The implementation is a matter of choice dependent onthe performance and other requirements of the computing system.Accordingly, the logical operations described herein are referred tovariously as states operations, structural devices, acts, or modules.These operations, structural devices, acts, and modules may beimplemented in software, in firmware, in special purpose digital logic,and any combination thereof. It should be appreciated that more or feweroperations may be performed than shown in the figures and describedherein. These operations may also be performed in a different order thanthose described herein.

Referring to FIG. 2, additional details will be provided regarding theoperation of the audience measurement module 110. In particular, FIG. 2is a flow diagram illustrating an exemplary method 200 for providingnetwork-based audience measurement, in accordance with some embodiments.The method 200 begins at operation 202, where the audience measurementmodule 110 intercepts data traffic between the client computer 106 andthe content server 104. For example, the sniffer 146 may intercept thedata traffic. The method 200 then proceeds to operation 204, where theaudience measurement module 110 intercepts DNS queries, such as the DNSquery 134, that are transmitted from the user agent 118 to the DNSserver 120. For example, the sniffer 146 may intercept the DNS queries.When the audience measurement module 110 intercepts the DNS queries, themethod 200 proceeds to operation 206.

At operation 206, the audience measurement module 110 interceptsauthorization responses, such as the authorization response 140, thatare transmitted from the RADIUS server 128 to the NAS 126. For example,the sniffer 146 may intercept the authorization responses. The method200 then proceeds to operation 208, where the audience measurementmodule 110 retrieves provisioning data, such as the provisioning data136, from the provisioning database 124. The method 200 then proceeds tooperation 210, where the audience measurement module 110 retrievesregistry data, such as the registry data 142, from the registry database130. When the audience measurement module 110 retrieves the registrydata, the method 200 proceeds to operation 212.

At operation 212, the audience measurement module 110 retrieves entitydata, such as the entity data 144, from the entity database 132. Themethod 200 then proceeds to operation 214, where the audiencemeasurement module 110 merges the intercepted data traffic, the DNSqueries, the authorization responses, the provisioning data, theregistry data, and the entity data and identifies unique subscribers andcontent names based on the merged information. In particular, theaudience measurement module 110 may utilize the DNS queries, theauthorization responses, and/or the provisioning data to identifycontent names. Further, the audience measurement module 110 may identifycontent names through the HTTP headers of the intercepted data packetsor through the registry data 142. When the audience measurement module110 identifies the unique subscribers and the content names, the method200 proceeds to operation 216.

At operation 216 the audience measurement module 110 identifiesmachine-generated data packets and user-generated data packets in theintercepted data packets. The audience measurement module 110 thenremoves machine-generated data packets from the user-generated datapackets, thereby leaving only the user-generated data packets. Themethod 200 then proceeds to operation 218, where the audiencemeasurement module 110 consolidates content names to larger entitiesbased on the entity data 144. The method 200 then proceeds to operation220, where the audience measurement module 110 computes audiencemeasurement metrics based on the identified unique subscribers, theidentified unique content names, and the user-generated data traffic.

FIG. 3 and the following discussion are intended to provide a brief,general description of a suitable computing environment in whichembodiments may be implemented. While embodiments will be described inthe general context of program modules that execute in conjunction withan application program that runs on an operating system on a computersystem, those skilled in the art will recognize that the embodiments mayalso be implemented in combination with other program modules.

Generally, program modules include routines, programs, components, datastructures, and other types of structures that perform particular tasksor implement particular abstract data types. Moreover, those skilled inthe art will appreciate that embodiments may be practiced with othercomputer system configurations, including hand-held devices,multiprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and the like. Theembodiments may also be practiced in distributed computing environmentswhere tasks are performed by remote processing devices that are linkedthrough a communications network. In a distributed computingenvironment, program modules may be located in both local and remotememory storage devices.

FIG. 3 is a block diagram illustrating a computer system 300 configuredto provide network-based audience measurement, in accordance withembodiments. The computer system 300 includes a processing unit 302, amemory 304, one or more user interface devices 306, one or moreinput/output (“I/O”) devices 308, and one or more network devices 310,each of which is operatively connected to a system bus 312. The bus 312enables bi-directional communication between the processing unit 302,the memory 304, the user interface devices 306, the I/O devices 308, andthe network devices 310.

The processing unit 302 may be a standard central processor thatperforms arithmetic and logical operations, a more specific purposeprogrammable logic controller (“PLC”), a programmable gate array, orother type of processor known to those skilled in the art and suitablefor controlling the operation of the server computer. Processing unitsare well-known in the art, and therefore not described in further detailherein.

The memory 304 communicates with the processing unit 302 via the systembus 312. In one embodiment, the memory 304 is operatively connected to amemory controller (not shown) that enables communication with theprocessing unit 302 via the system bus 312. The memory 304 includes anoperating system 316 and one or more program modules 318, according toexemplary embodiments. Examples of operating systems, such as theoperating system 316, include, but are not limited to, WINDOWS, WINDOWSCE, and WINDOWS MOBILE from MICROSOFT CORPORATION, LINUX, SYMBIAN fromSYMBIAN LIMITED, BREW from QUALCOMM CORPORATION, MAC OS from APPLECORPORATION, and FREEBSD operating system. The program modules 318include an audience measurement module 110. In some embodiments, theaudience measurement module 110 is embodied in computer-readable mediacontaining instructions that, when executed by the processing unit 302,performs the method 200 for providing network-based security services,as described in greater detail above with respect to FIG. 2. Accordingto embodiments, the program modules 318 may be embodied in hardware,software, firmware, or any combination thereof.

By way of example, and not limitation, computer-readable media maycomprise computer storage media and communication media. Computerstorage media includes volatile and non-volatile, removable andnon-removable media implemented in any method or technology for storageof information such as computer-readable instructions, data structures,program modules, or other data. Computer storage media includes, but isnot limited to, RAM, ROM, Erasable Programmable ROM (“EPROM”),Electrically Erasable Programmable ROM (“EEPROM”), flash memory or othersolid state memory technology, CD-ROM, digital versatile disks (“DVD”),or other optical storage, magnetic cassettes, magnetic tape, magneticdisk storage or other magnetic storage devices, or any other mediumwhich can be used to store the desired information and which can beaccessed by the computer system 300.

The user interface devices 306 may include one or more devices withwhich a user accesses the computer system 300. The user interfacedevices 306 may include, but are not limited to, computers, servers,personal digital assistants, cellular phones, or any suitable computingdevices. The I/O devices 308 enable a user to interface with the programmodules 318. In one embodiment, the I/O devices 308 are operativelyconnected to an I/O controller (not shown) that enables communicationwith the processing unit 302 via the system bus 312. The I/O devices 308may include one or more input devices, such as, but not limited to, akeyboard, a mouse, or an electronic stylus. Further, the I/O devices 308may include one or more output devices, such as, but not limited to, adisplay screen or a printer.

The network devices 310 enable the computer system 300 to communicatewith other networks or remote systems via the network 108. Examples ofthe network devices 310 may include, but are not limited to, a modem, aradio frequency (“RF”) or infrared (“IR”) transceiver, a telephonicinterface, a bridge, a router, or a network card. The network 108 mayinclude a wireless network such as, but not limited to, a Wireless LocalArea Network (“WLAN”) such as a WI-FI network, a Wireless Wide AreaNetwork (“WWAN”), a Wireless Personal Area Network (“WPAN”) such asBLUETOOTH, a Wireless Metropolitan Area Network (“WMAN”) such a WiMAXnetwork, or a cellular network. Alternatively, the network 108 may be awired network such as, but not limited to, a Wide Area Network (“WAN”)such as the Internet, a Local Area Network (“LAN”) such as the Ethernet,a wired Personal Area Network (“PAN”), or a wired Metropolitan AreaNetwork (“MAN”).

Although the subject matter presented herein has been described inconjunction with one or more particular embodiments and implementations,it is to be understood that the embodiments defined in the appendedclaims are not necessarily limited to the specific structure,configuration, or functionality described herein. Rather, the specificstructure, configuration, and functionality are disclosed as exampleforms of implementing the claims.

The subject matter described above is provided by way of illustrationonly and should not be construed as limiting. Various modifications andchanges may be made to the subject matter described herein withoutfollowing the example embodiments and applications illustrated anddescribed, and without departing from the true spirit and scope of theembodiments, which is set forth in the following claims.

What is claimed is:
 1. A method for providing network-based audiencemeasurement, the method comprising: receiving, by a computer, datapackets intercepted from between a client computer and a content server,wherein the data packets comprise requests to access content from thecontent server via a web server on the content server; identifying, bythe computer, unique subscribers and content names based on the datapackets; determining, by the computer, that a data packet of the datapackets is machine generated; removing, by the computer, the data packetdetermined to be machine generated from the data packets, wherein thedata packets remaining after the data packet determined to be machinegenerated is removed are user-generated data packets; and computing, bythe computer, an audience measurement metric based on the uniquesubscribers, the content names, and the user-generated data packets,wherein the audience measurement metric comprises an amount of timespent by a user accessing the content via the client computer.
 2. Themethod of claim 1, further comprising intercepting domain name systemqueries to a domain name system server, wherein the content names areidentified by merging the data packets and the domain name systemqueries.
 3. The method of claim 1, further comprising interceptingauthorization responses from a remote authentication dial in userservice server, wherein the unique subscribers are identified by mergingthe data packets and the authorization responses.
 4. The method of claim1, further comprising retrieving provisioning data from a provisioningdatabase, wherein the unique subscribers are identified by merging thedata packets and the provisioning data.
 5. The method of claim 1,further comprising retrieving registry data from a registry database,wherein the content names are identified by merging the data packets andthe registry data.
 6. The method of claim 1, wherein determining that adata packet of the data packets is machine generated comprisesdetermining that the data packet is directed to an update server.
 7. Themethod of claim 1, wherein the audience measurement metric furthercomprises at least one of a number of the unique subscribers, a datatraffic volume, a number of data flows generated, a number of hitsgenerated, an amount of time spent downloading content from the contentserver, and an amount of time spent downloading and viewing content fromthe content server.
 8. A system for providing network-based audiencemeasurement, comprising: a processor; and a memory storing instructionsthat, when executed by the processor, cause the processor to performoperations comprising: receiving data packets intercepted from between aclient computer and a content server, wherein the data packets compriserequests to access content from the content server via a web server onthe content server, identifying unique subscribers and content namesbased on the data packets, determining that a data packet of the datapackets is machine generated, removing the data packet determined to bemachine generated from the data packets, wherein the data packetsremaining after the data packet determined to be machine generated isremoved are user-generated data packets, and computing an audiencemeasurement metric based on the unique subscribers, the content names,and the user-generated data packets, wherein the audience measurementmetric comprises an amount of time spent by a user accessing the contentvia the client computer.
 9. The system of claim 8, wherein theinstructions, when executed by the processor, cause the processorperform further operations comprising intercepting domain name systemqueries to a domain name system server, wherein the content names aredetermined by merging the data packets and the domain name systemqueries.
 10. The system claim 8, wherein the instructions, when executedby the processor, cause the processor perform further operationscomprising intercepting authorization responses from a remoteauthentication dial in user service server, wherein the uniquesubscribers are identified by merging the data packets and theauthorization responses.
 11. The system of claim 8, wherein theinstructions, when executed by the processor, cause the processorperform further operations comprising retrieving provisioning data froma provisioning database, wherein the unique subscribers are determinedby merging the data packets and the provisioning data.
 12. The system ofclaim 8, wherein the instructions, when executed by the processor, causethe processor perform further operations comprising retrieving registrydata from a registry database, wherein the content names are determinedby merging the data packets and the registry data.
 13. The system ofclaim 8, wherein determining that a data packet of the data packets ismachine generated comprises determining that the data packet is directedto an update server.
 14. A computer-readable storage device storinginstructions that, when executed by a processor, cause the processor toperform operations comprising: receiving intercepting data packetsintercepted from between a client computer and a content server, whereinthe data packets comprise requests to access content from the contentserver via a web server on the content server; identifying uniquesubscribers and content names based on the data packets; determiningthat a data packet of the data packets is machine generated; removingthe data packet determined to be machine generated from the datapackets, wherein the data packets remaining after the data packetdetermined to be machine generated is removed are user-generated datapackets; and computing one or more an audience measurement metricmetrics based on the unique subscribers the content names, and theuser-generated data packets, wherein the audience measurement metriccomprises an amount of time spent by a user accessing the content viathe client computer.
 15. The computer-readable storage device of claim14, comprising further instructions that, when executed by theprocessor, cause the processor to perform rising intercepting domainname system queries to a domain name system server, wherein the contentnames are identified by merging the data packets and the domain namesystem queries.
 16. The computer-readable medium storage device of claim14, storing further instructions that, when executed by the processor,cause the processor to perform operations comprising interceptingauthorization responses from a remote authentication dial in userservice server, wherein the unique subscribers are determined by mergingthe data packets and based-en the authorization responses.
 17. Thecomputer-readable storage device of claim 14, storing furtherinstructions that, when executed by the processor, cause the processorto perform operations comprising retrieving provisioning data from aprovisioning database, wherein the unique subscribers are determined bymerging the data packets and the provisioning data.
 18. Thecomputer-readable storage device of claim 14, storing furtherinstructions that, when executed by the processor, cause the processorto perform operations comprising retrieving registry data from aregistry database, wherein the content names are determined by mergingthe data packets and the registry data.
 19. The computer-readablestorage device of claim 14, wherein determining that a data packet ofthe data packets is machine generated comprises determining that thedata packet is directed to an update server.
 20. The computer-readablestorage device of claim 14, wherein the audience measurement metricfurther comprises at least one of a number of unique subscribers, a datatraffic volume, a number of data flows generated, a number of hitsgenerated, an amount of time spent downloading content from the contentserver, and an amount of time spent downloading and viewing content fromthe content server.